CVE-2026-98537 workqueue: Fix NULL current_pwq deref in flush dependency check

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in flush dependency check checkflushdependency uses currentwqworker to determine whether the caller is a workqueue worker and then dereferences worker-currentpwq to test whether the current...

CVE-2026-98537

The Linux kernel contains a vulnerability in the workqueue subsystem where the check_flush_dependency() function performs a NULL pointer dereference . The issue occurs because current_wq_worker() confirms the process is a workqueue worker, but the worker->current_pwq pointer remains NULL if th...

EUVD-2026-103582

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in flush dependency check checkflushdependency uses currentwqworker to determine whether the caller is a workqueue worker and then dereferences worker-currentpwq to test whether the current...

CVE-2026-98537 workqueue: Fix NULL current_pwq deref in flush dependency check

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in flush dependency check checkflushdependency uses currentwqworker to determine whether the caller is a workqueue worker and then dereferences worker-currentpwq to test whether the current...

EUVD-2026-103763

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...

CVE-2026-98523 drm/client: fix restore of partially initialized client

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...

CVE-2026-98523

The Linux kernel contains a vulnerability in the drm subsystem where a NULL pointer dereference can occur when closing a DRM file descriptor. The issue stems from drm_client_register() adding a client to the device list before the hotplug callback completes; if the callback fails, the client rema...

CVE-2026-98523 drm/client: fix restore of partially initialized client

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...

CVE-2026-98522 drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvrmmumapsgl Map failure from pvrmmumapsgl interface was not returned correctly to pvrmmumap interface. This resulted in pvrmmumap interface to continue instead of returning ...

EUVD-2026-103762

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvrmmumapsgl Map failure from pvrmmumapsgl interface was not returned correctly to pvrmmumap interface. This resulted in pvrmmumap interface to continue instead of returning ...

CVE-2026-98522

The Linux kernel contains a vulnerability in the drm/imagination driver where the pvr_mmu_map_sgl() interface failed to correctly propagate map failures to the pvr_mmu_map() interface. This flaw caused pvr_mmu_map() to continue execution instead of returning an error to the caller, potentially le...

CVE-2026-98522 drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvrmmumapsgl Map failure from pvrmmumapsgl interface was not returned correctly to pvrmmumap interface. This resulted in pvrmmumap interface to continue instead of returning ...

EUVD-2026-103750

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

CVE-2026-98510 drm/xe/vm: nuke PTs only after unlinking contested VMAs

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

CVE-2026-98510

The Linux kernel contains a race condition in the drm/xe/vm component. In xe_vm_close_and_put(), xe_vm_pt_destroy() was incorrectly invoked before processing contested VMAs, destroying vm->pt_root while VMAs remained linked to buffer objects. If a concurrent thread evicts a shared buffer objec...

CVE-2026-98510 drm/xe/vm: nuke PTs only after unlinking contested VMAs

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

EUVD-2026-103748

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtiogpufencealloc can fail due to memory pressure and return NULL, but its caller like virtiogpuinitsubmit never checks it. Later, virtiogpuinitsubmit passes...

CVE-2026-98508

The Linux kernel contains a vulnerability in the drm/virtio component where a NULL pointer dereference occurs during fence allocation failures. Specifically, the function virtio_gpu_fence_alloc() can return NULL under memory pressure, but the caller virtio_gpu_init_submit() fails to validate this...

CVE-2026-98508 drm/virtio: fix NULL pointer dereference on fence allocation failure

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtiogpufencealloc can fail due to memory pressure and return NULL, but its caller like virtiogpuinitsubmit never checks it. Later, virtiogpuinitsubmit passes...

CVE-2026-98508

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtiogpufencealloc can fail due to memory pressure and return NULL, but its caller like virtiogpuinitsubmit never checks it. Later, virtiogpuinitsubmit passes...